0xC2: Cross-platform C2 framework for Windows, Linux, MacOS

Seraphbyte · 7 Ağu 2024

What is this?

The New Command and Control framework or as we say "C2", "C&C". From the graph view It has some similarity with Cobalt Strike, but let's see a little info about this new C2, even it is on state <<Available soon>>
---
! C&C (also known as C2) is a method that cybercriminals use to communicate with compromised devices within a target company’s network.

Features

Tradecraft written as Position Independent Code in C for Windows, Linux and MacOS, x86_64 and aarch64.

Modular agents with support for runtime configuration, full user-defined customization and built-in evasion tactics.

Embedded Lua engine for scripting capability.

---
! If it's some "exotic" programming language as Lua, then plus one in the step of AV/EDR bypass

License to 0xC2 software, authorized only for legitimate pen-testing/red-teaming, is offered for €4,500.
No doubts, soon we'll see weaponization by threat actors. As soon as, nowadays AV/EDR/XDR, Detections using Machine Learning, and any kind of intelligence are easily "catching" Cobalt Strike or any other popular C2, rats, this framework will be very "useful" for conducting targeted attacks.
Reference
https://www.0xc2.io/

Seems I forgot to drop official announcement of Creator of this framework 0xC2, in the X platform:

"Over a year ago, I left my position at WithSecure to start a new journey, create something new, and do my own thing. Today, I'm excited to publicly announce what I've been working on all this time.Introducing 0xC2, a cross-platform C2 framework targeting Windows, Linux, and MacOS environments: https://0xc2.ioThe first release was back in late 2023, initially only offered to a small circle of red teamers and soon, the registration will be open for new clients who provide threat simulation services.All agents are written as *** in C to provide better opsec and to allow operators to be more flexible when designing payloads. To make the agents modular and fully customizable, operators can create a user-defined virtual table that can be hooked by the agent. This can be used to change the default behavior of an agent or extend capabilities, from adding internal commands to implementing P2P protocols.More details will be available soon."

In Turkish his message as follows:

"Bir yıl kadar önce, WithSecure'deki pozisyonumu bırakarak yeni bir yolculuğa çıkmak, yenilikler yaratmak ve kendi yolumu çizmek üzere yola çıktım. Bugün, bu süre zarfında üzerinde çalıştığım projeyi kamuoyuna duyurmaktan heyecan duyuyorum.
İşte karşınızda 0xC2: Windows, Linux ve MacOS ortamlarını hedefleyen çok platformlu bir C2 çerçevesi: 0xc2.io
İlk sürüm, 2023'ün sonlarında, başlangıçta sadece küçük bir kırmızı takım grubuna sunuldu. Yakında, tehdit simülasyon hizmetleri sunan yeni müşteriler için kayıtlar açılacak.
Tüm ajanlar, daha iyi operasyon güvenliği sağlamak ve operatörlerin yükleri tasarlarken daha esnek olabilmesini temin etmek amacıyla C dilinde *** (Position Independent Code) olarak yazılmıştır. Ajanları modüler ve tamamen özelleştirilebilir hale getirmek için, operatörler ajan tarafından kullanılabilecek kullanıcı tanımlı bir sanal tablo oluşturabilirler. Bu, bir ajanın varsayılan davranışını değiştirmek veya yeteneklerini genişletmek için kullanılabilir; örneğin, dahili komutlar eklemek veya P2P protokollerini uygulamak gibi.
Daha fazla detay yakında paylaşılacak."

X cube0x0 post:

https://twitter.com/x/status/1821179746480210390

if in translation there're mistakes, feel free to write

alexandre20 · 10 Ağu 2024

selling a rat for 4.5k seems a bit crazy considering its not even a proper FUD rootkit

Seraphbyte · 10 Ağu 2024

alexandre20' Alıntı:
selling a rat for 4.5k seems a bit crazy considering its not even a proper FUD rootkit

but advisories don't wait for proper rootkit, important thing is beacon's new signature which is unknown by most AV/EDRs. Who knows maybe in the future there will be further optimizations

alexandre20 · 10 Ağu 2024

Seraphbyte' Alıntı:
but advisories don't wait for proper rootkit, important thing is beacon's new signature which is unknown by most AV/EDRs. Who knows maybe in the future there will be further optimizations

Even roblox cheats randomize their file signatures by shipping individual builds at this point, it is really not a big deal to evade file hash based ""antiviruses"". This could however be useful if its combined with actual runtime evasion techniques like remote-fetched control flow redirection and other advanced techniques that you would generally see in an anticheat. But unfortunately this tool's current approach will not even get close to bypassing any actual EDR solution

Seraphbyte · 10 Ağu 2024

alexandre20' Alıntı:
Even roblox cheats randomize their file signatures by shipping individual builds at this point, it is really not a big deal to evade file hash based ""antiviruses"". This could however be useful if its combined with actual runtime evasion techniques like remote-fetched control flow redirection and other advanced techniques that you would generally see in an anticheat. But unfortunately this tool's current approach will not even get close to bypassing any actual EDR solution

right, maybe that's why it's in state demo, not started selling license. Currently advanced techniques (I mean Enterprise level security solutions) are not easy as it seems. For better approach every droppers/malware family are creating own unique set of combination ways from staring hell's gate,...api hashings, different type of ghost injections and many more. Like this tools I think they will never be more better without your own customizations/modifications

Dilulya · 12 Ağu 2024

Seraphbyte' Alıntı:
What is this?
The New Command and Control framework or as we say "C2", "C&C". From the graph view It has some similarity with Cobalt Strike, but let's see a little info about this new C2, even it is on state <<Available soon>>
---
! C&C (also known as C2) is a method that cybercriminals use to communicate with compromised devices within a target company’s network.

Features

Tradecraft written as Position Independent Code in C for Windows, Linux and MacOS, x86_64 and aarch64.

Modular agents with support for runtime configuration, full user-defined customization and built-in evasion tactics.

Embedded Lua engine for scripting capability.

---
! If it's some "exotic" programming language as Lua, then plus one in the step of AV/EDR bypass

License to 0xC2 software, authorized only for legitimate pen-testing/red-teaming, is offered for €4,500.
No doubts, soon we'll see weaponization by threat actors. As soon as, nowadays AV/EDR/XDR, Detections using Machine Learning, and any kind of intelligence are easily "catching" Cobalt Strike or any other popular C2, rats, this framework will be very "useful" for conducting targeted attacks.
Reference
https://www.0xc2.io/

Seems I forgot to drop official announcement of Creator of this framework 0xC2, in the X platform:

"Over a year ago, I left my position at WithSecure to start a new journey, create something new, and do my own thing. Today, I'm excited to publicly announce what I've been working on all this time.Introducing 0xC2, a cross-platform C2 framework targeting Windows, Linux, and MacOS environments: https://0xc2.ioThe first release was back in late 2023, initially only offered to a small circle of red teamers and soon, the registration will be open for new clients who provide threat simulation services.All agents are written as *** in C to provide better opsec and to allow operators to be more flexible when designing payloads. To make the agents modular and fully customizable, operators can create a user-defined virtual table that can be hooked by the agent. This can be used to change the default behavior of an agent or extend capabilities, from adding internal commands to implementing P2P protocols.More details will be available soon."

In Turkish his message as follows:

"Bir yıl kadar önce, WithSecure'deki pozisyonumu bırakarak yeni bir yolculuğa çıkmak, yenilikler yaratmak ve kendi yolumu çizmek üzere yola çıktım. Bugün, bu süre zarfında üzerinde çalıştığım projeyi kamuoyuna duyurmaktan heyecan duyuyorum.
İşte karşınızda 0xC2: Windows, Linux ve MacOS ortamlarını hedefleyen çok platformlu bir C2 çerçevesi: 0xc2.io
İlk sürüm, 2023'ün sonlarında, başlangıçta sadece küçük bir kırmızı takım grubuna sunuldu. Yakında, tehdit simülasyon hizmetleri sunan yeni müşteriler için kayıtlar açılacak.
Tüm ajanlar, daha iyi operasyon güvenliği sağlamak ve operatörlerin yükleri tasarlarken daha esnek olabilmesini temin etmek amacıyla C dilinde *** (Position Independent Code) olarak yazılmıştır. Ajanları modüler ve tamamen özelleştirilebilir hale getirmek için, operatörler ajan tarafından kullanılabilecek kullanıcı tanımlı bir sanal tablo oluşturabilirler. Bu, bir ajanın varsayılan davranışını değiştirmek veya yeteneklerini genişletmek için kullanılabilir; örneğin, dahili komutlar eklemek veya P2P protokollerini uygulamak gibi.
Daha fazla detay yakında paylaşılacak."

X cube0x0 post:

https://twitter.com/x/status/1821179746480210390
if in translation there're mistakes, feel free to write

Sure waiting, I hope itll not take years to fully preparation

0xC2: Cross-platform C2 framework for Windows, Linux, MacOS

Seraphbyte

Katılımcı Üye

alexandre20

Uzman üye

Seraphbyte

Katılımcı Üye

alexandre20

Uzman üye

Seraphbyte

Katılımcı Üye

Dilulya

Yeni üye

Sosyal medya sayfalarımız